How to Prepare for an ISO 27001 Audit
A practical readiness checklist for your first internal audit and, eventually, external certification — what to have in place before the auditor arrives.
Two Kinds of Audit
There are two audits worth preparing for, and they build on each other. Your internal audit is one you run yourselves (or with a contracted internal auditor) to check the ISMS is working before anyone external looks at it. Your external certification audit is conducted by an accredited certification body in two stages — Stage 1 reviews your documentation and readiness, Stage 2 tests whether the controls are actually operating. A well-run internal audit programme is the best preparation for both.
Scheduling Your First Internal Audit
Click Schedule Audit and define a scope you can realistically complete — a single Annex A category or process is a better first audit than “the whole ISMS.” Assign a lead auditor who is independent of the area being audited (even in a small team, avoid auditing your own work), and set criteria: the specific policy, control, or clause you're checking against. See Internal Audits for the full status workflow and how findings and corrective actions are tracked.
Readiness Checklist
Before your first internal audit — and well before booking a certification audit — work through this list:
- Statement of Applicability is initialised and every applicable control has a documented implementation status, not left at the default.
- Core policies (at minimum the Information Security Policy) are created from templates, reviewed, and approved — not sitting in Draft.
- Risk Register has your organisation's actual risks logged and scored, each with a treatment decision.
- Evidence exists for controls you've marked as implemented — auditors will ask to see proof, not just a status field.
- Findings from previous audits (if any) have documented corrective actions, not left open.
- A management review has taken place and been documented, showing leadership oversight of the ISMS.
You don't need every item perfect — auditors expect a maturing ISMS, not a finished one. What matters is that gaps are known, tracked, and being worked on rather than invisible.